[CRITICAL] buffers: buffer_insert_line2 must not change the ->w entry

Krzysztof Oledzki reported that 1.4-dev7 would regularly crash
on an apparently very common workload. The cores he provided
showed some inter-buffer data corruption, exactly similar to
what was fixed by the following recent commit :

bbfa7938bd74adbfa435f26503fc10f5938195a3 [BUG] buffer_replace2 must never change the ->w entry

In fact, it was buffer_insert_line2() which was still modifying the
->w pointer, causing issues with pipelined responses in keep-alive
mode if some headers were to be added.

The bug requires a remote client, a near server, large server buffers
and small client buffers to be reproduced, with response header
insertion. Still, it's surprizing that it did not trigger earlier.

Now after 100k pipelined requests it did not trigger anymore.

diff --git a/src/buffers.c b/src/buffers.c
index 9aa8c3d1153e1c6523a5779b7f09c198560b570a..5f3cc2c440e27b910373d273e584a929cd0da639 100644 (file)
--- a/src/buffers.c
+++ b/src/buffers.c
@@ -287,7 +287,6 @@ int buffer_insert_line2(struct buffer *b, char *pos, const char *str, int len)
 
        /* we only move data after the displaced zone */
        if (b->r  > pos) b->r  += delta;
-       if (b->w  > pos) b->w  += delta;
        if (b->lr > pos) b->lr += delta;
        b->l += delta;